Privacy policy

Last updated: October 2026

This is an English translation of our German privacy policy (Datenschutzerklärung). The legally binding version is the German Datenschutzerklärung.

We take the protection of your personal data seriously and treat it confidentially in accordance with the statutory data protection regulations (GDPR, BDSG, TDDDG) and this policy. This website only collects the data that is technically necessary to operate it. Audience measurement via Google Analytics and Vercel Analytics only takes place if you actively consent in the cookie banner. Without your consent, no analytics script is loaded and no cookie is set.

1. Controller

2. What data we collect

2.1 Server log files (Vercel)

When you visit this website, your browser automatically transmits technical data to our hosting provider. The following is collected:

• IP address (shortened / pseudonymized)
• Date and time of access
• URL requested and HTTP status code
• Browser type, operating system, referrer

Purpose: providing the website, security, error analysis.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation).
Retention period: up to 30 days, then automatic deletion.
Processor: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. A data processing agreement (DPA) is in place; data is transferred on the basis of the EU Standard Contractual Clauses.

2.2 Data stored locally in your browser (localStorage)

This website uses your browser's local storage to offer convenience features. This data does not leave your device and we cannot see it.

• Bookmarks - which articles you have saved
• Poll participation - your choice in community polls
• Article feedback - whether you found an article helpful, plus an optional note
• Sign-ups for article notifications - a local copy of what you entered (see 2.3)
• Language choice - whether you chose the German or English version of the website, so we do not show you the language notice again

You can delete this data at any time: in your browser settings under "site data" or "localStorage" for the domain thehorseloop.de.
Legal basis: Art. 6 (1) (f) GDPR and § 25 (2) no. 2 TDDDG (technically necessary for the functions requested by the user).

2.3 Sign-up for article notifications

On some topic placeholders, you can leave your email address to be notified as soon as a particular article goes online. When you submit the form, we transmit your email address and the topic (slug) to our email service provider, which sends us a notification of your sign-up.

• Data collected: email address, article slug, timestamp
• Purpose: to notify you as soon as the article is published
• Legal basis: Art. 6 (1) (a) GDPR (consent by submitting the form)
• Retention period: until the article is published or until you object to the storage (email to hallo@thehorseloop.de)
• Processor: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. A DPA is in place; transfer on the basis of the EU Standard Contractual Clauses.

2.4 Contacting us directly by email

If you write to us directly (for example via the mailto link on the contact page or in the mailbox section), your email with all its content is delivered to hallo@thehorseloop.de. Our mailbox is hosted by Proton AG (Switzerland).

• Purpose: answering your request, adding your topic suggestion to our editorial planning
• Legal basis: Art. 6 (1) (b) GDPR (pre-contractual / editorial request), or (f) for pure feedback
• Retention period: as long as necessary to process your request, at most 24 months
• Processor: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland. Switzerland has an adequacy decision from the European Commission.

2.5 Fonts from Google Fonts

We load fonts (Fraunces, Source Serif 4, JetBrains Mono, Caveat) via Google Fonts. When you open the website, Google may process your IP address. We plan to host a selection of fonts locally ourselves.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Legal basis: Art. 6 (1) (f) GDPR (consistent and appealing presentation of the content)
• Google privacy policy: policies.google.com/privacy

2.6 External images

Some images are loaded from the image service Unsplash (Unsplash Inc., USA). In the process, your IP address is transmitted to Unsplash. We are gradually replacing these with local images.

3. Cookies, audience measurement and tracking

On its own, this website sets no advertising cookies and no cross-device trackers. Audience measurement via Google Analytics 4 is only loaded at your express request.

3.1 Google Analytics 4 (only with your consent)

On your first visit to our site, we show you a small cookie banner at the bottom right in which you can consent to or reject audience measurement via Google Analytics. Both options are presented equally; rejecting does not restrict the functions of the website. Until you make your choice, no analytics script is loaded and no analytics cookie is set.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for users in the EU). Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
• Purpose: aggregated audience statistics (which articles are read, which device and browser types, approximate geographic area). We want to understand which topics resonate without identifying individual people.
• Data collected: shortened IP address (anonymization is active by default in GA4), device and browser properties, pages viewed, click events, approximate location (country/region), pseudonymous device ID. No form input or personal content is sent.
• Cookies: If you consent, Google sets the cookies _ga and _ga_YG6H3BW3KN with a storage period of up to 24 months.
• Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent). You can withdraw your consent at any time with effect for the future, see section 3.3.
• Retention period at the provider: event data in GA4 14 months (default setting).
• Transfer to third countries: Data may be transferred to the USA. A data processing agreement (DPA) with Google and the EU-US Data Privacy Framework serve as the basis for the transfer; the EU Standard Contractual Clauses apply in addition.
• Google privacy policy: policies.google.com/privacy
• Browser add-on for deactivation: tools.google.com/dlpage/gaoptout

3.2 Vercel Web Analytics & Speed Insights (only with your consent)

In addition to Google Analytics, we use Vercel's cookieless audience and performance measurement. It is controlled via the same cookie banner and only loaded after you consent. If you decline, no Vercel analytics script is run.

• Provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (also our hosting provider, see section 2.1).
• Purpose: Web Analytics - aggregated audience statistics (page views, referral sources, approximate geographic area); Speed Insights - measuring actual loading performance (Core Web Vitals such as LCP, CLS, INP) to improve the website technically.
• Data collected: page viewed, referring URL (referrer), approximate location (country/region), device and browser type, and technical performance metrics. No form input or personal content is sent.
• Cookies: none. Vercel sets no cookies and no persistent device identifier. To distinguish visits, Vercel creates a non-reversible hash with a daily changing key from technical information (including IP address and user agent); this rules out recognition across several days or other websites.
• Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent). You can withdraw your consent at any time with effect for the future, see section 3.3.
• Transfer to third countries: Data may be transferred to the USA. A data processing agreement (DPA) is in place with Vercel; the transfer is based on the EU Standard Contractual Clauses.
• Vercel privacy policy: vercel.com/legal/privacy-policy

3.3 Managing your consent

You can change your choice at any time. Your current decision is stored in your browser under the key thl.consent.analytics in localStorage (values: granted or denied).

Change cookie settings

Alternatively, you can delete your browser site data for thehorseloop.de. The banner will then appear again on your next visit.

4. Your rights

Under the GDPR, you have the right at any time to:

• Access the data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure of your data ("right to be forgotten", Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent you have given with effect for the future (Art. 7 (3))

Write to us at hallo@thehorseloop.de, and we will process your request promptly.

5. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

(The Hamburg Commissioner for Data Protection and Freedom of Information)

6. Practitioner directory

At /verzeichnis/ we run a regional directory of equine service providers (vets, equine hospitals, farriers, therapists). The directory is in German. Below we explain how personal data is processed in this context.

6.1 What data is processed?

The directory contains public business contact details of equine service providers: company name, address, phone number, email address, website and, where publicly available, information on services and emergency availability. This is exclusively business contact data, not private data of natural persons.

6.2 Legal basis

Processing is based on our legitimate interest under Art. 6 (1) (f) GDPR. Our legitimate interest is to provide horse owners with a regional search function for veterinary care. The data processed is business contact data that the businesses themselves have made publicly accessible, so the intrusion is minor.

6.3 Source of the data

The entries come from publicly accessible sources: the OpenStreetMap database (license: ODbL) and manual research on the providers' own business websites. No data is taken from private profiles, social networks or paid directories.

6.4 Right to object and to erasure

Every listed provider can object to the processing at any time and request the removal of their entry. For this purpose, every provider card in the directory has a link „Eintrag entfernen lassen" (request removal of entry), which opens a corresponding form. Alternatively, you can contact us by email. We verify your identity using the stored business contact details and deactivate the entry promptly.

6.5 Self-listing and claiming an entry

Using the forms „Anbieter eintragen" (add a provider) and „Eintrag beanspruchen" (claim an entry), service providers can list themselves or claim an existing entry. The data entered (practice/business name, address, contact details, logo if applicable) is sent by email to our editorial team and added to the directory after manual review. Logo files are stored on Vercel Blob (Vercel Inc., USA). The legal basis is your consent (Art. 6 (1) (a) GDPR), which you give by submitting the form.

6.6 Removal form

If you use the removal form, the data you enter there (your name, contact details, relationship to the entry, reason if applicable) is used exclusively to process your request and is deleted once processing is complete. The data is transmitted in encrypted form (TLS) to our email service provider Resend (Resend Inc., USA). The legal basis is Art. 6 (1) (f) GDPR.

7. AMA questions to experts

At /ama/ we hold question rounds ("Ask me anything") with experts from equine practice. The rounds are in German. Using a form, you can ask the expert of the round a question. We publish selected questions together with the answer on our website, without your name and without your email address. We only publish your information about the horse (for example breed, age, hooves, history) if you separately consent to this in the form; we never publish photos and videos.

• Data collected: information about your horse (as far as you provide it, for example age, breed, housing, hooves, history, medication, feeding), your question, optionally your email address for follow-up questions, optionally photos and short videos of your horse that you upload, timestamp of the submission
• Purpose: answering your question by the expert of the round and editorial publication of selected questions and answers
• Recipient: We pass your question, the information about the horse and uploaded photos and videos on to the expert of the respective round: round 1, Kristiane Hartwig; round 2 (from October 23, 2026), farrier Fidelius Lewens. Your email address stays with us; follow-up questions to you go exclusively through our mailbox hallo@thehorseloop.de.
• Legal basis: Art. 6 (1) (a) GDPR (consent, which you give by submitting the form)
• Retention period: four weeks after the answers are published, we delete the submissions of the round from the database and all files uploaded for it, including the questions that were not answered. After that, only the anonymously published questions and answers remain.
• Withdrawal: You can withdraw your consent at any time with effect for the future and request the deletion of your question by email to hallo@thehorseloop.de. Please state the question round and the wording of your question or the email address you provided so that we can find the entry.
• Processor: The submissions are stored in a database at Supabase, uploaded photos and videos in the file storage of the same Supabase project (Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992). The database server is located in the EU (AWS region eu-west-1, Ireland). A data processing agreement (DPA) is in place; insofar as Supabase accesses data from a third country in the course of support or maintenance, this is done on the basis of the EU Standard Contractual Clauses.

8. Changes to this policy

We adapt this privacy policy when legal requirements or functions of our website change. The version published on this page applies in each case.